Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/09/2026, 14:37
Behavioral task
behavioral1
Sample
2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe
- Size 1.3MB
- Sample260929-ry63lascnb
- SHA256 89edd59ab48d37585118dcce905f532563b2667b3e5530f79148d27365edd801
- MD5 e798134879e5f0cfa9447d8ec7005e2f
- SHA1 ccf45c92b16f106f0248bf52d7a43db448b0ac81
- SHA512 71a3f53e7ef406da8fb8480f52adf9d26bec4bbc42f794544b15c4ee7bf5680f611a28f65ce1d4f72b89823a0107858fe1711ad641b0737fccf84412a3a57f39
- SSDEEP 24576:WfJ4yL/tNCJPXUQrP3sTBt3byAUHWreGf+jY+JqRp5fl9NJn:WfJ4klKXn/sltLyvH88YzRp5/NJn
- TLSH T1B865239331E0C077DD7A57740A54E2028A25FDC69EBE91A77DC05189FEF43932A6C32A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
pid Process 3900 elevation_service.exe 936 elevation_service.exe 2688 OSE.EXE 6060 PerceptionSimulationService.exe 5560 perfhost.exe 2884 ReFsDedupSvc.exe 4848 SensorDataService.exe 900 ssh-agent.exe 912 AgentService.exe 5196 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe - Drops file in System32 directory 47 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e9134031b68fd3f0.bin elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe -
resource yara_rule behavioral2/memory/4604-0-0x0000000000400000-0x00000000006A3000-memory.dmp upx behavioral2/memory/4604-58-0x0000000000400000-0x00000000006A3000-memory.dmp upx behavioral2/files/0x00010000000093b2-76.dat upx behavioral2/memory/4604-78-0x0000000000400000-0x00000000006A3000-memory.dmp upx behavioral2/files/0x000100000000994e-77.dat upx behavioral2/files/0x0001000000009323-75.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 264 4604 WerFault.exe 87 - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8036c502050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000527fc50f2050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000642b2f102050dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec0c570f2050dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fb997122050dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000320f71502050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000071fa37102050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3900 elevation_service.exe 3900 elevation_service.exe 3900 elevation_service.exe 3900 elevation_service.exe 3900 elevation_service.exe 3900 elevation_service.exe 3900 elevation_service.exe 936 elevation_service.exe 936 elevation_service.exe 936 elevation_service.exe 936 elevation_service.exe 936 elevation_service.exe 936 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4604 2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe Token: SeTakeOwnershipPrivilege 3900 elevation_service.exe Token: SeBackupPrivilege 2884 ReFsDedupSvc.exe Token: SeRestorePrivilege 2884 ReFsDedupSvc.exe Token: SeBackupPrivilege 2884 ReFsDedupSvc.exe Token: SeRestorePrivilege 2884 ReFsDedupSvc.exe Token: SeBackupPrivilege 2884 ReFsDedupSvc.exe Token: SeRestorePrivilege 2884 ReFsDedupSvc.exe Token: SeBackupPrivilege 2884 ReFsDedupSvc.exe Token: SeRestorePrivilege 2884 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 912 AgentService.exe Token: SeBackupPrivilege 2884 ReFsDedupSvc.exe Token: SeRestorePrivilege 2884 ReFsDedupSvc.exe Token: 33 5196 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5196 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5196 SearchIndexer.exe Token: SeDebugPrivilege 3900 elevation_service.exe Token: SeDebugPrivilege 936 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5196 wrote to memory of 1676 5196 SearchIndexer.exe 103 PID 5196 wrote to memory of 3440 5196 SearchIndexer.exe 104 PID 5196 wrote to memory of 3332 5196 SearchIndexer.exe 105 PID 5196 wrote to memory of 928 5196 SearchIndexer.exe 106 PID 5196 wrote to memory of 5448 5196 SearchIndexer.exe 108 PID 5196 wrote to memory of 2060 5196 SearchIndexer.exe 109 PID 5196 wrote to memory of 6048 5196 SearchIndexer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_e798134879e5f0cfa9447d8ec7005e2f_elex_karagany_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 7202⤵
- Program crash
PID:264
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4604 -ip 46041⤵PID:4664
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2688
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:6060
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5560
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4848
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:900
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:912
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1676
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3440
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3068 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:3332
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3036 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:928
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5448
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3036 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2060
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3068 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:6048
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 685d03d75a19c578a6eebd43cb32f647c17191fac33380b5dec013fff4e2a07c
- MD5 81997d81cef5b9cadabbdc89170a5deb
- SHA1 e0e763508a2d5dac577bcb4b657e30c6ab3061d7
- SHA512 43dfdd1e7cf253ce0faa154071957dc217ad9bf96cc56b365e69c32854b7a1cd4ffefdc866960b390cac064ab95bcedb8f339605681ba59aa36294f0affa847a
- SSDEEP 49152:nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKfJ4klKXng:V3q6mjBdfJ4k
- TLSH T175D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 ce0602eabe6bef48634b3c3d9cdb7d1ab32ff8c984d028616b0a9f4209d7a90e
- MD5 85a872d9da94abf47ebc84b3e7ea11e3
- SHA1 5a236913d7c27d8e1c41d3d3edd87f2eb5e23b1f
- SHA512 46bdf95bbe893a8fcfb922366afb64132b392aa587ee56ece72613142333fae794f789adbf8707d28cbba472432f66178c056f0e16956e84c746e352051e911d
- SSDEEP 12288:Y1XLsswWkxy2lRq2czAtfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:eXYfDtczAtfJ4yL/tNCJPXUQrPx
- TLSH T15405F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 f8c776082447965bb78016ae6f8ce24c2d3c222a5106500f65143861b253c7d9
- MD5 09bfd4160bc1b7b4eabb7e6ab28fa7c8
- SHA1 93201dd2f48f8f58274b75d3d8af4c85c2a66e72
- SHA512 ecf63e0071056fa6ac6b243cfe85fd16a0ee0fbe8665798034b97254537c4a95dc8f051eb691dac647560c6e0d4c6d142c0edab95a50046c9bcbbc355cccd766
- SSDEEP 24576:m0Le5ji0hmxhrMnfJ4yL/tNCJPXUQrPd:mPji0AzSfJ4klKXnl
- TLSH T1FF35AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 c4a5269727d4e229482cd140b87db6f0500be797ffc064f07fd86c77943811ec
- MD5 3801f6c6650e4c527eeb28c91884895c
- SHA1 0bc38b9ee463215397e78431334e0f353e1a4d68
- SHA512 187a23da0bc32812979a9a247327d37e37d92c43bac2fb53a2f40a25ca71329989d2624b4d558e5953adc5dff743b7d628adeef092ecb402b32bf8b1b2231416
- SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWj6q8wyudfJ4yL/tNCJPXUQrPb:W/ezSC6vUzPv+HjymfJ4klKXnz
- TLSH T142756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 0f40171df0d7b95cf307d65fc2aa26d486a1e3e407f6e74fc0485b81d6f563c6
- MD5 aa77d31aedab97303100c0ba1e259f85
- SHA1 131a3489cb4f2c3b541d977fe4de8279dda33057
- SHA512 ba5f089dfb0b66e9928a665a2d11dcdf2b2fdbf161054d52499f7f9305b67c0c223e6a42b15c2648433ec89c26540387cbe518de657815b30a289a00098cf49c
- SSDEEP 24576:9VbqPb88hv/l+BEfJ4yL/tNCJPXUQrPv:9VO88hXl+yfJ4klKXn3
- TLSH T1C3559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 b3407cd139d20a31ad94d9654750f2e4b9367e1f69e9470419a1fe10ddde949b
- MD5 747f524c64765da47a2d6d9cc6354082
- SHA1 e933ae8e48aba021fbbe9e655b10a4cf3af7c954
- SHA512 ddd927b3b6aa5344520167bbcb1900e5c34b684df3ebea07aad56947eba385b05795f0e03c286b6affe57bf9e9acfc35f702829c46dbef147eed4b09bbd53d7b
- SSDEEP 12288:+GjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:+GjfJ4yL/tNCJPXUQrPn
- TLSH T174C423E751909086DF6687F82A88F001C704BEC5562FA2E7DE82B8C67FFC91A559C353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 468671b4661039a3a43b4cfdfefced54e206f4b18e2fbd694df391ebc7702c78
- MD5 e7357927926edebd73acb7e8416e505a
- SHA1 61bd0fe857b29521ba63ec9edc49a5368d4ae08a
- SHA512 1c0f46e043083dfef2cb47271e6399ce932a90e6ff9b0211f55ec24712b88bf2214c380bd75c5ed5b6ff153db2c3f00ac8b06095de0897f4f0fd61c80bd14844
- SSDEEP 12288:DeBNUbTVO86UcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:DJIUcfJ4yL/tNCJPXUQrPO
- TLSH T11605C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 bf9a7643f2bd3ecea23f4115d4c70e42c06fbcb54fe43c5ae1ce96c208e07ce6
- MD5 9e5c53a19e9440af8b9bd699abfaa2b7
- SHA1 e927abfcbee20485a83c3301f7931d6002ccfb88
- SHA512 c5a662bbf80cac7042c9ba1d4b48cc2699acc67208f63a0c0b91becccc1db92259915054b3b9ea71d6a56951b281d134236e25191b17275f7d9f237e3952b545
- SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:LQvGAdlCEL8c/WRNw5CtfJ4k
- TLSH T1F9266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 70a651b07d504aa54809406cf6445b606cd395581b9e813ae51e25282b773b32
- MD5 9a979ca7dbfcb624de3482a52bf52179
- SHA1 8bb3082c7b882324be7909adb4ab95ca59f45dd4
- SHA512 0c4163edeee16a1a24a3f01b5dab1ff391c441f4e8ff1459a04e3541644e5fb14680d699900584235ba992fedb9b525d3ced06708d1c97f54fc10dfd9d0ddf06
- SSDEEP 12288:xAwSfxL/2Dc3mDLLmt0LDQewsAjifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWk:SfewsAjifJ4yL/tNCJPXUQrPG
- TLSH T11315E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f16d04944f51febed0b980c611f1c07776058b7d7ac7802aa3729852aca67eb7
- MD5 1e201a68d8c3759dc022c1760fac6a99
- SHA1 cfd62c46c2b9fa5685546886a9f34df46466ab9b
- SHA512 a1a3dbc963819ceef8367c4713ce76ef3d265a370722178322ec3df320609c5fbe6dd2bc084abb0088832a41f30cbbdfc6f350202caccec0d9274630972398cb
- SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHqfJ4:YUEtQevvqc2W1cpV20I32q
- TLSH T173474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 3b0952d0c6460b2c24b11abbe8c6f32f62564303ea34c1c152f75d185545358e
- MD5 220158a8c00650d3bbc113b42df4e88c
- SHA1 db5e58bd713c7983fbcd35378281e6b7b4febded
- SHA512 b19cd7e861359673cfcf6973ce038e66ed035c20753bc786197f88c4181de6664c8ea36c9d8cf6e54c9ec82a74ba17f08bb06aab5c59abe46a7be5b8f1f2b184
- SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/zCfJ4klKXny:loqtVjnmBfJ4k
- TLSH T19ED58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 30c4ee8727189cef290e4f96dc522e0999e8f2e115db3086f327bb66dea1b2de
- MD5 d29c2e54e536c46ab7bd9b9ef4eb2c05
- SHA1 8c0f5e810f70c2db8f8fd8102119a7c9c97cb70b
- SHA512 726ce40dd91141fb7972dbd31f6042a463139fba6b0a66b79056dcaec1f1b8b21157872062eca3669978b917ce52dc674acd68aec2332b469e410f663972635b
- SSDEEP 24576:aAhGL6IFoiwtA5l7S53hfJ4yL/tNCJPXUQrPi:aAM5Foiq5RfJ4klKXn6
- TLSH T15F359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 e6020ac161b2faabffdf5ab8b541ede2523e0cb3c9e2e4359f43d0dcd24ac952
- MD5 4af8ecf268b0af66bf37040406e2c236
- SHA1 add0e04ceb3507e682e1345a93e55305ab743f2c
- SHA512 917846ba71f3c47228d005aeeeda087e805d8047a7e154184b4acb6c1b1c4a09a2f8b0e67790492e66abea40958e5b20e36772a269ef379fc847704e73972e66
- SSDEEP 12288:1mw5HEjsChNEBFgl0WDm+CofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTi:wwuROW3fJ4yL/tNCJPXUQrPW
- TLSH T16105F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 b891dcf454ed1d89376ae4297e1c99610ac2dae0918299221651ae7a3bbb9529
- MD5 1a18f14652ea11648337ddc58c6ec2fd
- SHA1 e48df0a16c6db80a794b97462926676412e2c8ef
- SHA512 0324992d7f0fb7df8666daf335cf06ef38a5ee661d6c9edc64cde36b9ca0b9ef4365478341bafe8943ac2d3342b123ab4ac5fb2279cb0878bd462f755ede0b5b
- SSDEEP 12288:hyZ1IyyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:oZu/fJ4yL/tNCJPXUQrPz
- TLSH T1A9E4129B32D460F9DAA782BC89D4E101D3317C92273A43CF5A5195963FBBAC61D3D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 1f5e9f550a2c8b9e3fb8c78ea8ceb1843d5dea3ffca9c928bdabf7637017ce2f
- MD5 7a5d9d8717bc58d7b1ba471ee88ffc2e
- SHA1 01fd6ea6d79347f0d0a74c4b888e3822c9c4de4f
- SHA512 a7ad90a2d8529024df47c2ac80ad9171f45b6d97e6e76fd84615828099f5c74733a82b7f23d86a777e2b4b4795ea6b296b73cf7a47234ac921b295942faab986
- SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UD:ZQRQyi36YOcPDLvw2gAf+PN3wfJ4k
- TLSH T19E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 fd495e6aa30d15aec0af7d59370f4c71d779951f19d43bb6d982f528877be67b
- MD5 6de7dcc8355ca6bfca3a2929cd8354ab
- SHA1 c1faf310afa2f73895d7bbf1cbba667a051405ae
- SHA512 ce845ac01bb1a6a5bbd5cdb70ca15303389203ca6ca8d3c37ea5f4974ec86ce10d769a0b831ab0387b277111b05759cb6d3527b0681d9e539829500ed7bd301d
- SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UL:wQRQyi36YOcPDLvw2gAf+PN3wfJ4k
- TLSH T153667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 00ea015882b55189c664776c8869672e9bd8849220ef7b1f44233d8d82bf84e7
- MD5 0bf050bce67a42038abd747b5480c9b4
- SHA1 9c47c25ca403812f0144e0ca9eb2ef5a9376a480
- SHA512 ac2a991b89dddac21dd0b98e8027df9476bb96030a05d2900eba65f644fd93387eba0ceefba78b249fc9e5405aa88a712b6edea6170f5588cf6e5faa1d6f247e
- SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0vfJ4yL/tNCJPXUU:x68Qg55nhkeWu7PNU3/SfJ4klKXnv
- TLSH T134B55933B2F200A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 1704cb017e3be89b4fa336ebaaf567e8c7aaf9d19f7e8a019dc5db44008cd02f
- MD5 584aa56d12b238f0fe038fc758066e53
- SHA1 8810800fa7f0ee6e7024bfc99a9fcda804e026fb
- SHA512 781af8e25efd608f8630075c2ffb63c2b073a9ca8caf6f8e408949675676d6379a66de9e4c19c887e30642d1a3259c8b91d1204d0da115043a82565e40f534d8
- SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99e:ky5112gYy5azzVvU69nLKnhZjfJ4k
- TLSH T18C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 fd5fa84b40add7cefddf57001d66dc258d919f5bdf6114f13d5904eacc369d33
- MD5 beaa17ca059804d8bbc65fda9515199a
- SHA1 7cbfe84802cd279738aa73b311aeaf3b5eec946e
- SHA512 b04edf0fd37aa01fe4e8ae5a898fe049f69478add83d116976fc4bf90cc37c056fb6082c3813dba992faf904b28653fee1e570f6a8fe4c3354e45e3858a57d99
- SSDEEP 49152:FB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glxfJ4klKXnu:ru6JmIxd2dxfJ4k
- TLSH T126D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7187804bae177921bc3c0ffea253bab3d4919f7268e3f71852c7ce39b40a450c
- MD5 bb62d3af292af9e05701b91a8b0f4900
- SHA1 8cf7f7d0499ee82fa2aed556cd8245c1e14973f8
- SHA512 8b6c0bd541b52ad9cbbdac4cfe41a9fcb4e83d841e0c67368f793f746eeecea4a5d14c2e7b279806293f76bddc3530f870d131a16cb12020104aa30ada923d86
- SSDEEP 49152:C1hpsNoJpF1A67U44CwH7R4x8fJ4klKXnw:CmifPqRBfJ4k
- TLSH T1D2B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 f8b8c383926c38912d5bbf904a0720e48f6f35c08c81737e5e5b2f466c13b5fb
- MD5 2a10bfb848f6cf30d97283715e8a1690
- SHA1 45aadbf43d87527c7e9371740c75f9064a22848a
- SHA512 c69edcccddeae20b262a49d2d6e36685f4f3aae0a4ae28ba47267735204b488416b92ef018a45bfc06f3bd07219ca97bc21a316154a99ecf5d5b6a85b5d131f5
- SSDEEP 49152:kSuZQIY0Be2KkRVtOnks6NMHq/fJ4klKXna:25dKqi61/fJ4k
- TLSH T11FC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 02b1d3430e190c417ecef6c129a4ba4574a611946fd20e12ef72f14b50e9f96d
- MD5 4a5ed2e12cbdae1f2e3d6792991471f2
- SHA1 f80460d3ea11cfe452ef6ed94f547c931dd95e54
- SHA512 cb1731e57fa535e22967c816f08bfb67f2a76e40e4d9f7477cfee0c3f9965433e9ba5f59885c5dd72f7760804a8fa4023275e3ef04b15e7b6333f093241015a1
- SSDEEP 49152:PhtSn8EApI0figjgiDn0AP5wYfJ4klKXnO:eX2iWphVfJ4k
- TLSH T1C295BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 7d449b3d7629521dce45977517ed8f1785087c3ce5b1226d2ace05eb79f9c7b5
- MD5 a20fd7871f8c7bf3e0a03d0a581ecd5a
- SHA1 742eceea4096677cb6cb3320bf4712dba3d54162
- SHA512 6f611cf1530511b30fbb8018fa0b96b13064e6d2d6a077e5dde2a04470ab7482e65d159c02350a7ccdb99922c95f44c532060c5e7e77108d0621ee7e3065b835
- SSDEEP 12288:pbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:pbfJ4yL/tNCJPXUQrPD
- TLSH T14EC423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF42B4427FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 a60f43653b2b54049917d68db75d3dcc6b966dba52f88e36321c7f9b261f6beb
- MD5 1e0a0839df1ff5a1c077e4ae45bd0f9a
- SHA1 1eaa39c8a7ada3fdf141f336e17dd104df0b4ee2
- SHA512 b4bc60d04e154eafd42016a5be92e1309593ea3a0a064504b7f329a5525bc117418de7d39aea2673849b1d5086ea57bbff5c5e04090476376e7c6e17010fb341
- SSDEEP 12288:FufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:FufJ4yL/tNCJPXUQrPk
- TLSH T139C423AB60D5948ADE1587F81648F001C7047EC6672F62F7EF42B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 f1ad503d814963430e186a6dba759bd69c0317d11426c6e0eb444df937af4ae9
- MD5 3ad0996b63183681ac8af7e404df6301
- SHA1 0affc31e72ec5b110fbbeb6f13ded124028dbdd8
- SHA512 24737fa17a9c00efd66a3bfe8449a66f88442cf3767699db4525e5ab26e1ade83507806c8d2d2ade302f0bda5c2cea083da244f0493040296ab0594105dedcad
- SSDEEP 12288:F0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:F0fJ4yL/tNCJPXUQrPk
- TLSH T188C423AB60D5948ADE1587F81648E001C7047EC6672F62F7EF83B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 2f66c29b27620633d29f43b9120197def4312fe9c687afaba94c18ac1f083a93
- MD5 7651d68f7471e052f8dd29c9b5d02515
- SHA1 0ba834025a68e98208aab7ba2551513b7f8576dd
- SHA512 41ea203604e97168051b2f247a3a95555824bb5167be7640dae7906069248662a9e50112e5143421b2efe60329a0008c9f5bfc1da6df6e777f91251b70ce1472
- SSDEEP 12288:HVBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:rfJ4yL/tNCJPXUQrPH
- TLSH T1BAD42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 6044b78fecc76e4eeee8d8f40a7ac1f08fe0b397cc29046ecdf84be874b6baf6
- MD5 658cf8ed299f120463f54ae6576adcfe
- SHA1 fda0bc6d2b79331f60b5797caeb275bfc501dc23
- SHA512 8072a13db85b98e084cc13dac52d1a505bffe1cb4c906bde84fca1c4282c62144d27030bce47587bbef0223d09138a6622cc92da884dff426822406cab8b3844
- SSDEEP 12288:EpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:EpfJ4yL/tNCJPXUQrPm
- TLSH T182C423AB60D5948ADE1587F81648E001C7047EC6672F62F7EF82B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 8f4dbe672909e4f76c93201e23927330595fefea857421ac452dde3738552ec8
- MD5 8ab76564fc3066a3a546b518e20de618
- SHA1 02cd04736252fd9248b326356603eb0ac5806084
- SHA512 419ab20c5c1d60b3f4a348ff94f9ce8918641618522f320ebeed87c4fd4baf780ce3159f9350e09e4f05b0aeb56f93cca6b450c382dbb0f975bbd159689f1cd1
- SSDEEP 12288:V6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:V6fJ4yL/tNCJPXUQrPm
- TLSH T147C423AB60D5948ADE1587F81A48F001C7047EC6672F62F7EF42B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 233a1002170f76e93569a6dae69427660fa02a3a47936fbaf71c041fd540f285
- MD5 564ed82a85c775b851bd154f2332810c
- SHA1 8c5c5385a8d3f1a941c42242fb5a10d36162d0f2
- SHA512 17a06cacf1272f13e21cc2793972d8b57bb30744fd2f99a2bcb7851c223dd83566713b3037da7793ec734634a728e5dfc388a51309fd32e16664efb517f926a4
- SSDEEP 12288:s2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:s2fJ4yL/tNCJPXUQrPJ
- TLSH T138C423AB6095948ADE6587F81748F000C7047EC6672F62F7EF42B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 e4c6bb5fb0ad0052c14a4e603ffac4f61cf3cdf78263c1246b151a702231c467
- MD5 6b333f6f74cc81ff3aeec6caf71d8846
- SHA1 ac3fba32fc3273f97d8f26d375cb976b243a76f9
- SHA512 01a443a54351e231256626c06a5692f785ee53ed2bab28c61134cc2c5dd771905a675f1548d4ab37424c147e09fed48dfac630a7f9fbb7717d9b1c0d4f6514d4
- SSDEEP 12288:LiZwbDzzFEoS2cPvyOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:2ZM3zFVSOOfJ4yL/tNCJPXUQrPz
- TLSH T10D0501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 8c9c210f69d5ce644017064d83e3e91e7f5b56aff314aceb6f84b34c3bfa2817
- MD5 b81e57a0ad7ec2e2e664e20b5f908b12
- SHA1 56f06210ca2dbd5da5469b45d43ff3d0e0cc1710
- SHA512 367e2fd2e800599bb0a0660a3aa3149e7adc8e33f7465f0bbee6cbb82e3efbee5c52ceba698c5130ba3e3fa1a3a8442df45a6032bae7797ed2b08268ba8e4bd5
- SSDEEP 12288:hPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:hPfJ4yL/tNCJPXUQrPP
- TLSH T16AC423AB6095948ADE1587F81748E001C7087EC6672F62F7EF43B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 f741e34ee2164cc073ed3632adff8853c85462a3b6666aa8a5fb87b86db6f9f8
- MD5 270aa4696f36bf8357ee03cca22aa2a0
- SHA1 d523c8bfb2d587c55a8fd0e1875c8d3753205274
- SHA512 7d2f9927ebf6390f459b56a3721e09135ab269e2a88eeae46099487d0a4301beac994abf3ef8409136d046806df74e7ebfa9b77404a9f680f9cfdc29f8930818
- SSDEEP 12288:PzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:PzfJ4yL/tNCJPXUQrPP
- TLSH T1FCC423AB60D5948ADE1587F81748E001C7087EC6672F62F7EF42B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 a37cb625b457a3c357a9c55598fa585e295e1e666bdb9b36c364e635dba461a7
- MD5 c5a9893becb650c6ce0ea12b00da4cd7
- SHA1 26229999be18080f36fd06e6fd8a25a6a9796279
- SHA512 fbc2f4ae5f5c64fd0685c5850002899f1aad2680c8a1d5e3350c562f974a121ed199e4b4d95d319a9a53979ae534e06cf2d4f39b89cad276c93e2ab5b215d6c5
- SSDEEP 12288:ZyPz5L8yfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:YzyyfJ4yL/tNCJPXUQrPB
- TLSH T1AEF4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3E770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 6faf113287d094c60645a2a2981eadbf90b36a761bea70d6a224c33d76ac73b4
- MD5 2dced140c2c0e216e30cc463afd7ef94
- SHA1 3679624792bbf9a07f7a5493ed9147a590df296f
- SHA512 b7f12f1b3ede2e6208d1ea25324aa14785c70acabcb78491e63b6efd3d1b7108782e1ec4abc8c28ebb84dbf7ae39ff5f3fa048af936ec00009a223a95dabe816
- SSDEEP 12288:IPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:IPfJ4yL/tNCJPXUQrPL
- TLSH T1F6C423AB60D5948ADE5587F81748E000C7087EC6672F62E7EF43B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 f92a9fe048a34935bf098aac1ee60d703fa8ea6cd783807b02c0829fae16f573
- MD5 a41fee3f499f00dc16f82536df283db6
- SHA1 9ae839052b6fa0f4d13a4874a7248d15b771360b
- SHA512 467384a30932d139109260e70615dd5197ce661225dc0730751b76dac996e916330b775e30abc3c0527a31643862dbc3ab14bbcd672e7ddc2be0747f819cbd00
- SSDEEP 12288:sPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:sPfJ4yL/tNCJPXUQrPZ
- TLSH T13FC423AB6095948ADE1587F81748E001C7087EC6672F62E7EF43B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 2fa26e6eee608144d66839500cdcae0e0de1adc5c0bd0dc974857d72a45ec985
- MD5 89be97557154a7701bc52e0a6334063a
- SHA1 8204bc0abba6f1448a20aa6b224ac44608403970
- SHA512 bffbed09baf322f3717bf4f2e0fd7f87ec91cf2e9f2c36e1faf01fad2dd38cebd8a59430148a2fcb51f82ab75510e4d284661bdf3876d22b0f8e139aee5c9a1b
- SSDEEP 12288:YyPz5L8yfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:5zyyfJ4yL/tNCJPXUQrP/
- TLSH T1AEF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 be90151c4932b7c8ef9f9d99f6dfd33191068bf9f125fea4834813f0d625f03e
- MD5 ac8b8ebe6561f7d4b0549cba7fa53858
- SHA1 cd500661e1ec739cc275fba67053af428708e59c
- SHA512 0b2e86d7d8a02400d25e8c4e31cf8f70d8d41093d6d219ec395e5bd96c501b4ba613cd45cdb7c736263acbbcee67a2d8ad14f4fc6bea0ef52a5f825806c175ab
- SSDEEP 12288:bCd91WYoaLHF3z0z04PDvhkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTe:WT8aLl3z0zDkfJ4yL/tNCJPXUQrPa
- TLSH T1E40501A5B39018F8EC67827ECD549502D3B27C9A0770C26F07A436676F773A11C2DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 8e38ed51c21931e5543bdf801fba75e0cf69b6f265e0dbd245f64d9766455e1f
- MD5 0fe3920909610fe744729d99b1ceed74
- SHA1 458be91443d9f55f39d2e7a5eae84eb545d6ef1a
- SHA512 a8d32179efbf7f74baba6d10bb93718d15555fbeae0c821e0452a6ce5d91c082aa2f9707d25012ab7d2bf848f5ce229bda299b2cdac160fd6dceb9f9075e1323
- SSDEEP 12288:7i4e7+RdTfgwCHKy7GLbbdIvlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGL:73rd9CHKy7GZQfJ4yL/tNCJPXUQrPc
- TLSH T16F25CF91F3E410E8F0B7CA798D659501DA767C9A1B31DA8F03A4655A2F33BD18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 82f525c71722231978fd77faf15afa365b0450e04c37e0993a6372b540a4f3dd
- MD5 9e0823fdff32479a43267c819aafa9a0
- SHA1 698e3af7a794f2ef48c7be45c19c127597e817e9
- SHA512 9c79d86ed247a6786a0a0da12dcd8e5ed4fddd2703b3b6531708a01e0399dc0f4a768cb7e96b2206abd4ac4df46c3cb97a5e79e54c6c07075c05a7c3cf83d3ed
- SSDEEP 12288:9UfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:9UfJ4yL/tNCJPXUQrPL
- TLSH T12BC423AB6095948ADE1587F81648F001C7047EC6672F62F7EF83B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 56499b658d73812ef58d8ae67f8ce834054ee56db6b241d20a58c3ee251fa5c4
- MD5 048d3ed4d3f8ebcb34b76fb60a02422f
- SHA1 f5762fe012d55feeb6fa18af5506f3e4d41a8b71
- SHA512 9a3e1b0581e085b0c73b9f89cf32d1e1ae4c1ffb0f41affbd3468c0b12feedd71fd90b4d2bd62d6ad92f6c07615ba72877cb9fe07d7f13a43b253cd03b8f0afd
- SSDEEP 12288:GSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:GSfJ4yL/tNCJPXUQrPX
- TLSH T161C423AB60D1949ADE1587F81688E001C7047EC6672F62F7EF83B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 096935c9483bdcb2622014a24e303264c5f47f87cb02fa4a15452371cf69fea3
- MD5 847d20cb89bfe97dda1f3af4e47b2056
- SHA1 ae71dd7b31ebcc672cddfb6fdf608cc6a1cd910d
- SHA512 d9ca33cc2911867d052bbb500a5c31cbb0c6a13ce1662a5ffec297efb44ff91c67608a41aa6581545a7e9baae05356b9ef32f2585cf74e4921921ebe25f278c7
- SSDEEP 12288:mlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:mlfJ4yL/tNCJPXUQrPX
- TLSH T181C423AB6095948ADE5587F81788E000C7047EC6672F62F7EF83B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 5883ed0f68f26829606f01e38d16884a0fab714e21b6e46cf0ec39ceb8287a25
- MD5 2af939e37465d2d5e1bee77fa7da1a59
- SHA1 0ca3c623eb3ab15a2db7038abd70776375724b8e
- SHA512 7552925278be7b5d542d86152db9286b1037041a6be0a406bef84ec6294bd4f9b82daf9a275a6c19ad076aa9e2053545efb9020fd08b99fc173927f1bd98c2aa
- SSDEEP 12288:rPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:rPfJ4yL/tNCJPXUQrPT
- TLSH T1F8C423AB60D5948ADE1587F81748E001C7087EC6672F62E7EF83B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 90f946650c77cde6b9860a7b3acd93b93d924da543b4672cabd85824c202eb91
- MD5 db99708faefbd5c696620f83f8bb8a2c
- SHA1 a7b9b3d3907a382e81fff4d3ff1eca5603c2f6f6
- SHA512 eec60b803b70ad45fed7b0507490f06a844ee239c832bab9716ae90d4cece47ca5beb0497cb77ee6f6fc8ff5ec966921f24ea07a62b7ea0141b45bb84e786ff7
- SSDEEP 12288:7UfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:7UfJ4yL/tNCJPXUQrPv
- TLSH T12EC423EB6095948ADE1587F81688E001C7047EC6672F62F7EF83B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 766a99cac10b8e2cd2e277d73c7f5afe16514d918cbc072b873654b03bf023ac
- MD5 96f736066fbd9c3853036688289130df
- SHA1 2777b3a87da5d779840ddb26833c9ca715dcbbbc
- SHA512 f8e1df79b6b95b405b549cf08291a5cfce75e4d08448d7e415dadab84d0f601fbe99c9d55a2ca1ab2ff7d8d3eba7178ea90972528141c2304f944a944aee43ab
- SSDEEP 12288:dXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:dXfJ4yL/tNCJPXUQrPq
- TLSH T1B3C423AB60D5948ADE1587F81788E001C7087EC6662F62F7EF43B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 ffc1cf09beeba40e9f96322ae43a9c23f1538340ad6ba7976e06791452d1e8a1
- MD5 f1e2b47b2dc0bf45a8b9f8c502c99e89
- SHA1 0f55f3fb07887ffa7489425a10849a2582a7112d
- SHA512 0106952ec4543dfd91df6a56fdda76501e3463202cfd1c5d947daa58c1eb13c829a2c65577350f568798b7e0250c7065809465907547114959527890b97eb60c
- SSDEEP 24576:Lfwvzk9RX6wkyAIDfJ4yL/tNCJPXUQrPC:eMnYIDfJ4klKXn6
- TLSH T14035D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 176741c4e9d15af2c1cbb08c902bdf3c0574ca09efe1e41e3868f3facc3e2b33
- MD5 6a92315527a26827aa84ad4169df07f4
- SHA1 c129a48bec168a61a149f76f2ff71f449a309986
- SHA512 3d98902a889ee75adedded40c96bc04808b5d217658b15f506be30e3a0b559d3f01e36c0e135c1fa8539fc6d1b2ed1df700972092a59d121aaa554a9e6b9461e
- SSDEEP 49152:SYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04fJ4klKXny:9ySzPQfJ4k
- TLSH T1D9066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 acd93ad9c03452b88b7d11d4e53b199a6914b465fb1766039515219d3e8c50e0
- MD5 bb709be1b044c8f857093160a8adb97b
- SHA1 2fb253f1e9ea1a1646c2da5f51fe22ded53a3067
- SHA512 deef7e3546e5c19b5e05b18292b23b470219dad9bffd9f988f37c9b8ec0e588d90419ff67e0bc56c61ffd130cd0e15f768c77348f2dbccb627abcf37fee90a35
- SSDEEP 24576:T47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYefJ4yL/tNCJPXUQrPZ:T47JUQjqirIhCnDHUPfF/IfJ4klKXnh
- TLSH T1A165AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 8a43b2e7cd337971a4d3601439216d177b7af3b5d48d4d9c4d5b293ac109f268
- MD5 20e336c5d1a027927e16c9ee19bb2438
- SHA1 eb1523fc17666532da9470ef095a36e9dc587189
- SHA512 182266b1817e94d716a2173daeb15c74964cf59e5d8b0597230301db3da4ad513457de9ee055533d50040cd13b640cf6bad9a742c88ab3cce8cb404c7966368e
- SSDEEP 12288:kpsf/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:1/fJ4yL/tNCJPXUQrPO
- TLSH T161E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.0MB
- SHA256 db70288724dddad9fa4a23ba15d3f807bce28ab035531784ea9e20ee1995a0c3
- MD5 8eef833fbba54773a1e2409b71f8a1d6
- SHA1 dcd212cb9cb5fd558df64da90fd758af12ed134b
- SHA512 c59541d2869b824b3b9445e9c5d7b15e53f785cd3d72bcfabdda1ab1c35d10c64d5e1268ecf20165b421b2c68fd1931348444e5e49e5029a8ad276184ecaa58c
- SSDEEP 12288:n/eZXJlbt5aTBHPUTNUuPm5zoF4tfk177:n0avUTNtPozomVk1H
- TLSH T1943506007666CA8FC6A940361E37D5CCAB707D11EE44AF0773C9873F9576658BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.5MB
- SHA256 d444eb3d77584fe60a8e3f2d538180d51230b7ea3078e84484af3214a8e657fe
- MD5 06d44574c48df43f6704e802922c523b
- SHA1 12227d7766e8aa45069474b13b679f365693776d
- SHA512 e735fe4c6361907c4ba7e8e3aa5e6d4c88f12252fb1c6d92a4cc96d7578ff9ed82fc54ebc1fcf85c6d6f618e58a28dd6cb701710e47def237d42599d07651e93
- SSDEEP 12288:Xv4KjaQklzzipuj9Q4Pi/D5Qch8v/J1fueN0+hhy49V5NT:wKjvQ4U5NT
- TLSH T14275F8819437A78FC1BA6032072A5B4CBBB4EC0777055F26B3C9453AD82AB5670F93D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 80687c6050f271d28bf2fd5380719661d1beca33b2fb535d265a9595d1e919da
- MD5 575a31d1fc29f1a61e09275867dabe2a
- SHA1 c884409258bec127a76dec6068a934ce66f7a3ce
- SHA512 e9a0f67ac056741f5aac002814b9ed1cb8fb40a9de8bdea331ccaa427f31049fdb3e0b336366cc2897a89afc4f2a9b8c78c0d5e4327566b262987f4c1867f2f3
- SSDEEP 12288:lM7HfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:eHfJ4yL/tNCJPXUQrPZ
- TLSH T102D423A751D49846ED7687F8164CE000D309BED51B2BA2E7EE42B4817FFC98A1DBC352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 4221d429a76be9564a4fe16926995f45126c10b1faf578b6be0c6a71bc3fc392
- MD5 e67050951c245ce4aa0d40de57bde4e6
- SHA1 bd42833c8afdb2002193671a48ee6dedfe75473f
- SHA512 6771f42ca817ed77091878d1eb1f58a9dbe29a9ca5ba913e87caa50173b4f14e2c2fc29af66cf7d8f719497f65230c7e2dd023ae11d21af7d5c9614d601db81f
- SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYdfJ4yL/tNCJPXUQrP2:bgb4mBIBhGFefJ4klKXnO
- TLSH T14765AF1E22EC02F5E0F9D3B89DAA4417D6B278160732D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 828KB
- SHA256 fa5a0a792a3529f6585205108a1e62acc0bdab09cbb9004e4ca296ff2ac8b975
- MD5 2bae8d25a70937b1e459efce809f0401
- SHA1 fa62b0bb5ff833539ed989f9f38777c976161e5b
- SHA512 3d93eac983f88126a8744435fa2766362e605f2d8ff1ee41c4f7244751f1e619604725f9f3e7f83640164ce1e52a2cb188b1052e45da8a9520c725e85ca1e4dd
- SSDEEP 12288:pKGnrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9b:EGfTBt3byAUHWreGf+jY+JqRp5fl9NJn
- TLSH T19905229A21F520A9D57EA735097161227CB1B4916F7968FF0CE09279EF603E23239F1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 b74b35cc4039aca23669cc632dcdf2638b5d4ab705b427f35abb2a1259bfe79f
- MD5 38d11d026a252e7a81cdeed21662e968
- SHA1 98f8d67ff89673d8451ed1a0ef739c72b36b8910
- SHA512 994d77d42d8bc99799c45d925b1b010b4b548d3c7d0775dda3941acf424df391d840a0d0d508c50acee8dc96adacc52939746d6df71d175efc5619c94be7873e
- SSDEEP 24576:vG88u8FpJqH1vzria7/mOfJ4yL/tNCJPXUQrPJ:e7ZFPqVya7/FfJ4klKXnh
- TLSH T14D35026672E101F1D47BD1388A858663F771B8150375FBDF0BA88A512F23AE50B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 c572da9447bb0fd730624162dd06322873bc491453b6e5244fde525aca041040
- MD5 45a135a9fff901cf346ab83f22a91dc7
- SHA1 19fffa66adc862fc1b59699894dceb9913a01f09
- SHA512 999e8a8faf95c34a41cd12d772d3490d773ce46fcb37b0b83813d2367d08ac63127efe187327188b372d1307fe3c9637e29f0f494d36876f3236035761f929c1
- SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6fJ4klKXnE:uG05lO43brfJ4k
- TLSH T111D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 9a7cfc3afaa4fced7e6c8e735cf606e27357e5d943e93766c38f73fe476f92ea
- MD5 03048c31e66bb8741c9ed4fee788da1c
- SHA1 3ba60ff87405403375598a53b4f853dae8e62887
- SHA512 4c8ca7d2e15cb8a42a0b606fcfb2a5163e589870c835efbae9e66ef5d7bed3afdb2e150e0beee72ce8dcb2a5bb59bb4412259cfd952a3a2c35305b82eab28e19
- SSDEEP 24576:dfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn4fJ4yL/tNCJPXUQrPw:ta5POZ3lJt2pasx2+mSfJ4klKXn4
- TLSH T19F65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 ed3a5a22d936f00dba30b69fdc554cf94a4588245d4355667046bf76b1f88182
- MD5 75a0a540e94e311044155ae726180201
- SHA1 d8857ae9a93833d903d0ebb093524511cbf32695
- SHA512 9780004f86deb025ab0d7c8fc05745d1a9415762f35799b7504409328c572bb83f985b88eb17223074b9cb888c6df843d210ab300269237cd5dcf729a2c934b5
- SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkmfJ4yL/tNCJPXUQrPy:/Nc/zEOVHFlfJ4klKXnK
- TLSH T1AB858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 cafc6b04f8b93bec17067a1429c5818c6be2ec10eafebe2f54770410196a4ec9
- MD5 a77c51ba3222ca5643777ba255e82b88
- SHA1 ddd06d1db8d045879f07b2c45cae4e6ccd18a984
- SHA512 126f4ebefaf209858b826570530866422e0cc7759ee0d028cad3968119f25a3a78ec6f4462aff2467ab30f06d4436f8b11e48fa916b49e51b81156abd92ce430
- SSDEEP 24576:r6DIuTBt3byAUHWreGf+jY+JqRp5fl9NJn:r6DIultLyvH88YzRp5/NJn
- TLSH T13F25025D23BA10F6E07BE13D86930102E5B2F0619B6659DF09A4C1B99EA3FC9793CF05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.5MB
- SHA256 cd94296b5677252b81cb36a4858ff5470d65c58e1c460223f81f506fbc4661bb
- MD5 f095a48ca4d6d5378eee2bc4216c1a1c
- SHA1 e15ca38ea66e1b58131e95cfb3c4d93a5fdd3ac1
- SHA512 8476a6b15914c96a4f9ca2b5c76e890b43853ebc8994506ebaedac2de6f1eb8e53215ee8900b48bf6b2fadcc3bf915ad498c6a8531d7cca598c2f16a3474455d
- SSDEEP 24576:ETkNvNnaFeYhJNtmZBmxTBt3byAUHWreGf+jY+JqRp5fl9NJn:ETMwBtOmxltLyvH88YzRp5/NJn
- TLSH T1EF75BF6EA6F805E4E1FEC6748D238512EA727461073293CF5290C13F5E67AD89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 42e064455f6ebc3cd5168a59e35f84174e43c4b0d5887a0c707c774b01ae97dc
- MD5 5dddb3b534dedef8ef80a4801410408d
- SHA1 fad7a59b934ef15356ff89f9c49f020089b4482a
- SHA512 596df1dc6f6c431ff04d0bbb8b470a77aefefdea068e87cd2b80740c21d881542554c055f2c52c602fa7f2815ff58e323f431c16ed20639d425c147f5975cbd1
- SSDEEP 12288:wHvUrBFrEjwaQrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:wPUr+NQrfJ4yL/tNCJPXUQrPk
- TLSH T1CE05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 1ac4728f8c48b43f14c461a19712e70bd7b00ce3de211d9b913fb70e8722890d
- MD5 11244ea9131feab553c61348076f1abf
- SHA1 88ac4454a6201b765972323a1932cb69c990dda9
- SHA512 542b3d890e881f50170b3db8874e3a1b90b47db61932d576ce5d08eed590650204138dcf995aeec87b0042d17fb8fe2307f05bf42200cf89127a6f22923a64b1
- SSDEEP 12288:2QcMxWDXN1Dp/fshBItT1IQgA7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+G3:MD3FHshBIYQgA7fJ4yL/tNCJPXUQrPf
- TLSH T12B25E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0C1B62F6BEE42D3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH